Acra v0.92 releases: database protection suite

What is Acra

Acra helps you easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartmentalize data stored in large sharded schemes. Acra’s security model guarantees that if your database or your application get compromised, they will not leak sensitive data or decryption keys.

Acra gives you tools for encrypting the data on the application’s side into a special cryptographic container, storing it in the database, and then decrypt it in a secure compartmented area (separate virtual machine/container). The cryptographic design ensures that no secret (password, key, anything) leaked from the application or database will be sufficient for decryption of the protected data chunks that originate from it.

Acra was built with specific user experiences in mind:

• quick and easy integration of security instrumentation;
• cryptographic protection of data in the threat model where all the other parts of the infrastructure could be compromised, but as long as AcraServer isn’t compromised, the data is safe;
• proper abstraction of all cryptographic processes: you’re safe from the risk of selecting the wrong key length or algorithm padding;
• secure default settings to get you going;
• intrusion detection to let you know early that something wrong is going on;
• high degree of configurability to create the perfect balance between the extra security features and performance;
• automation/ops-friendly: most of Acra’s features were built to be easily configured/automated using a configuration automation environment.
• limited attack surface: to compromise an Acra-powered app, an attacker will need to compromise a separate compartmented server, AcraServer – more specifically – its key storage and database;
• easy to try: you can experience the full might of Acra without committing to its installation using Docker containers.

Acra is a continuously developing security tool. And as any proper security tool, it requires enormous human efforts for validation of the methods, code, and finding possible infrastructural weaknesses. Although we do run Acra in production in several instances, we’re constantly enhancing and improving it as we go. This is done to ensure that the provided security benefits are not rendered useless through implementation problems or increased complexity.

Cryptography

Acra relies on our cryptographic library Themis, which implements high-level cryptosystems based on the best available open-source implementations of the most reliable ciphers. Acra does not contain any self-made cryptographic primitives or obscure ciphers. Instead, to deliver its unique guarantees, Acra relies on the combination of well-known ciphers and smart key management scheme.

How does Acra work?

After successfully deploying and integrating Acra into your application, follow the 4 steps below:

• Your app talks to AcraConnector, local daemon, via PostgreSQL/MySQL driver. AcraConnector emulates your normal PostgreSQL/MySQL database, forwards all requests to AcraServer over a secure channel, and expects a plaintext output back.
• Then AcraConnector forwards it over the initial database connection to the application. It is connected to AcraServer via Secure Session or TLS, which ensures that the plaintext goes over a protected channel. It is highly desirable to run AcraConnector via a separate user to compartmentalize it from the client-facing code.
• AcraServer is the core entity that provides decryption services for all the encrypted envelopes that come from the database and then re-packs the database answers for the application. AcraCensor is a part of AcraServer that allows customizing the firewall rules for all the requests coming to the MySQL database.
• To write the protected data to the database, you can use AcraWriter library, which generates AcraStructs and helps you integrate it as a type into your ORM or database management code. You will need Acra’s public key to do that. AcraStructs generated by AcraWriter are not readable by it — only the server has the right keys to decrypt it.
• You can connect to both AcraConnector and the database directly when you don’t need encrypted reads/writes. However, increased performance might cost you some design elegance (which is sometimes perfectly fine when it’s a conscious decision).

Acra also has additional smaller components like AcraCensor firewall and a lightweight HTTP web server for managing AcraServer’s certain configuration options AcraWebConfig. To better understand the architecture and data flow, please refer to Architecture and data flow section in the official documentation.

The typical Acra workflow looks like this:

• The app encrypts some data using AcraWriter, generating AcraStruct with AcraServer public key and updates the database.
• The app sends SQL request through AcraConnector, which forwards it to AcraServer.
• AcraServer passes each query through AcraCensor (currently only works with MySQL databases), which can be configured to blacklist or whitelist some queries. AcraServer forwards the allowed queries to the database.
• Upon receiving the answer, AcraServer tries to detect the encrypted envelopes (AcraStructs). If it succeeds, AcraServer decrypts payload and replaces the AcraStructs with plaintext answer, which is then returned to AcraConnector over a secure channel.
• AcraConnector then provides an answer to the application, as if no complex security tool was ever working within the system.

Changelog v0.92

This release brings stability and performance fixes to AcraServer and AcraTranslator. It officially deprecates usage of AcraConnector in favour of TLS everywhere. Some default configuration params are changed in favour of more secure & better performance settings.

Core:

• AcraServer, AcraTranslator:
  • Improved TLS certificate validation performance with CRL. #482
  • Poison record detection turned off by default. Flag --poison_detect_enable changed default value from true to false. #484
  • Removed SecureSession and AcraConnector support as transport encryption. #481
  • Improved and clarified log messages. Removed messages with error level for success cases (not detected poison record), clarified context of messages. #487
  • Added suggestions in log messages how to solve issues with TLS connections. #493
  • Improved in-memory caching keys:
    • Added caching symmetric keys like asymmetric #489
    • Added caching metadata about rotated keys #498
    • Added new flag --keystore_cache_on_start_enable that turns on loading all keys into in-memory cache on startup. #497
    • Changed default value for --keystore_cache_size parameter from -1 (which means no limits for cache) to 1000 (cache items). #497
• AcraServer:
  • The default CryptoEnvelope has changed from acrastruct to acrablock in the encryptor_config. Now AcraServer will use faster encryption by default. You can select which CryptoEnvelope to use in encryptor_config. See AcraStructs vs AcraBlocks documentation, #485
  • Extended PostgreSQL’s SQL syntax support with null::<type> type casts. #479
  • Changed the default values for next CLI parameters:
    • --tls_client_id_from_cert changed from false to true. Now AcraServer require app’s TLS certificates and map them to keys. #481
  • Improved performance for:
    • querycapture handler in AcraCensor. #483
    • transparent encryption and poison record detection. #487, #496
    • searchable encryption. #490
  • Removed next CLI parameters due to removed AcraConnector support:
    • --securesession_id, --acraconnector_tls_transport_enable, --acraconnector_transport_encryption_disable. #481
• AcraTranslator: Now AcraTranslator works with TLS by default, it doesn’t support AcraConnector anymore. #481
  • Removed next CLI parameters due to removed AcraConnector support:
    • --securesession_id, --acratranslator_tls_transport_enable, --acraconnector_transport_encryption_disable. #481
• AcraKeymaker:
  • Now handle correctly generation symmetric keys into not existing folders. #486
  • Removed next CLI parameters due to removed AcraConnector support:
    • --generate_acraconnector_keys, --generate_acraserver_keys, --generate_acratranslator_keys. #481
• AcraKeys:
  • Removed next key types for all commands (generate, read, destroy): transport-connector, transport-server, transport-translator. #481
• AcraConnector:
  • Removed everywhere and stopped support. Switch to TLS instead, see Security controls > Transport Security > TLS, #481

Example projects and demos:

• Python examples: now support MySQL database. #476

Install && Use

Copyright 2015 Cossack Labs Limited